This vulnerability allows hackers to transform any Bluetooth-enabled device into a covert tracking tool, all without the owner's slightest inkling.
Dubbed "nRootTag," this exploit hoodwinks the Find My network into recognising ordinary gadgets—be it your laptop, smartphone, or even your child's gaming console—as if they were Apple's own AirTags.
Unsuspecting users are unwittingly broadcasting their every move to potential stalkers and cybercriminals.
The masterminds behind this alarming discovery revealed that, despite Job’s Mob’s claims of superior security, they cracked the system using "hundreds" of GPUs to swiftly unearth the cryptographic keys safeguarding Bluetooth addresses.
This method boasts a chilling 90 per cent success rate and doesn't demand any high-level hacking prowess.
In one hair-raising experiment, the team accurately tracked a cyclist's laptop, trailing the rider's journey through bustling city streets. In another, they meticulously mapped out an individual's flight itinerary by clandestinely monitoring their gaming device.
As one boffin put it: "While it is scary if your smart lock is hacked, it becomes far more horrifying if the attacker also knows its location. With the attack method we introduced, the attacker can achieve this."
Despite being alerted to this glaring security lapse in July 2024, the Fruity Cargo Cult has done nothing to fix it, offering little more than a cursory acknowledgement of the issue. No concrete solutions have been rolled out to safeguard users from this invasive threat.
In the meantime, experts are urging the public to be vigilant: scrutinise which apps you permit to access your Bluetooth and keep your device's software up to date.
Until Job’s Mob steps up and fixes the issue, every iPhone, iPad, and Mac user remains a potential target in this digital game of cat and mouse.